2021

This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization whe

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) a

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) a

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion L

Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker coul

Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files fr

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execu

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execut

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but ins

ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer

Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who snif

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CL

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by que

HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obt

Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenti

SilverStripe Framework through 4.8.1 allows XSS.

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP ad

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to

Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the

Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XM

ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.

The Unicorn framework through 0.35.3 for Django allows XSS via component.name.

When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to a

When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications

The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot characte

A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a

XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.

emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafte

Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploit

Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be

Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be

Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be

Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploit

WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php.

An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Grow